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Abstract,  We  propose  a  trust-threshold  based  routing  protocol  for  dela\ 
tolerant  networks,  leveraging  two  trust  thresholds  for  accepting 
recommendations  and  for  selecting  the  next  message  carrier  for  message 
forwarding.  We  show  that  there  exist  optimal  trust  threshold  values  under  which 
trust- threshold  based  routing  performs  the  best  in  terms  of  message  delivery 
ratio,  message  delay  and  message  overhead  By  means  of  a  probability  model 
we  perform  a  comparative  analysis  of  trust-threshold  based  routing  against 
epidemic,  social -trust-based  and  QoS-trust-based  routing.  Our  results 
demonstrate  that  trust-threshold  based  routing  operating  under  proper  trusi 
thresholds  can  effectively  trade  off  message  delay  and  message  overhead  for  a 
significant  gain  in  message  delivery  ratio.  Moreover,  our  analysis  helps  identify 
the  optimal  weight  setting  to  best  balance  the  effect  of  social  vs  QoS  trusi 
metrics  to  maximize  the  message  delivery  ratio  without  compromising  message 
delay  and/or  message  overhead  requirements 

Keywords:  Delay  tolerant  networks,  message  routing,  trust  management,  social 
trust,  QoS  trust,  trust-threshold  based  routing  performance  analysis. 


1  Introduction 

Delay  /Disruption  Tolerant  Networks  (DTNs)  are  self-organizing  wireless  networks 
with  the  characteristics  of  large  latency,  intermittent  connectivity,  and  limited 
resources  (c.g.,  battery  ,  computational  power,  bandwidth)  [1,  2]  Different  from  the 
traditional  networks  such  as  mobile  ad  hoc  networks,  the  nodes  in  DTNs  forward 
messages  to  a  destination  in  a  store-carry-and-fon\ard  manner  [1  2]  in  order  to  cope 
w  ith  the  absence  of  guaranteed  end-to-end  connectivity’.  That  is,  an  intermediate  node 
stores  a  message  received  from  a  sender  and  carries  it,  and  then  forwards  it  to  an 
encountered  node  which  continues  the  store-carry -and- forward  process  until  the 
message  reaches  the  destination  node.  In  such  environments,  the  key  challenge  is  to 
select  an  appropriate  “next  message  carrier"  among  all  encountered  nodes  to 
maximize  the  message  delivery  ratio  while  minimizing  message  o\erhead  and  delay. 
Further,  we  face  additional  challenges  due  to  a  lack  of  centralized  trust  entity.  The 
open,  distributed,  and  dynamic  nature  of  DTNs  also  induces  security  vulnerability  [2, 
3].  In  this  paper,  we  consider  a  DTN  in  the  presence  of  malicious  and  uncooperati\e 
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nodes  and  propose  a  method  for  the  selection  of  trust\vorth>  message  carriers  with  the 
goal  of  maximizing  the  message  delivery  ratio  without  compromising  message  delay 
or  message  overhead  in  the  context  of  DTN  routing. 

Most  current  DTN  routing  protocols  are  based  on  encounter  patterns  [4-7].  The 
problem  is  that  if  the  predicted  encounter  does  not  happen,  then  messages  would  be 
lost  for  single-copy  routing,  or  Hooded  for  multi-copy  routing.  Moreover,  in  the 
presence  of  selfish  or  malicious  nodes,  these  approaches  still  could  not  guarantee 
reliable  message  delivery'.  The  vulnerability  of  DTN  routing  to  node  selfishness  was 
well  studied  in  [8].  Several  recent  studies  [9-13]  used  reputation  to  select  message 
carriers  among  encountered  nodes  and  encouraged  cooperative  behaviors  using  credit 
incentives.  However,  a  centralized  credit  management  system  which  can  be  a  single 
point  of  failure  is  ty  pically  required,  as  it  is  challenging  to  perform  distributed  credit 
management  in  a  DTN  in  the  presence  of  selfish  or  malieious  nodes. 

The  rapid  proliferation  of  miniaturized  wireless  deviees  such  as  mobile  phones, 
smart  phones,  and  PDAs  makes  humans  beeome  deviee-carriers  Since 
communications  between  sueh  devices  are  possible  only  when  in  dose  proximity, 
their  contacts  are  elosely  related  to  the  social  relationship  or  interactions  [14]  From 
this  perspective,  recently  there  have  been  several  social  network  based  approaches 
[15-21]  to  select  the  best  message  carrier  in  DTNs.  [15-19]  considered  social 
relationship  and  social  networking  as  criteria  to  select  message  earners  in  DTNs. 
However,  no  consideration  was  given  to  the  presence  of  malicious  or  selfish  nodes; 
[20]  considered  routing  by  socially  selfish  nodes  in  DTNs,  taking  into  consideration 
the  willingness  of  a  socially  selfish  node  to  forward  messages  to  the  destination  node 
because  of  social  ties;  [21]  considered  social  trust  based  on  friendship,  familiarity  ,  and 
similarity  in  order  to  thwart  Sybil  attacks  in  D7Tis. 

This  work  extends  from  our  earlier  work  [22]  on  trust-based  routing  in  D'l*Ns.  Wc 
also  take  social  networking  into  consideration  in  designing  D7TJ  routing  protocols. 
However,  unlike  prior  work  cited  above,  we  integrate  social  trust  and  Quality  of 
Service  (QoS)  trust  into  a  composite  trust  metrie  for  determining  the  best  node  among 
the  new  encounters  for  message  forwarding.  In  this  work,  we  propose  the  design 
notion  of  trust  thresholds  for  determining  the  trustworthiness  of  a  node  acting  as  a 
recommender  or  as  the  next  message  carrier,  and  analyze  the  best  thresholds  under 
which  trust-threshold  ba«ed  routing  in  DTNs  would  perform  the  best  Our  approach  is 
distributed  in  nature  and  does  not  require  a  complicated  credit  management  system. 
Each  node  will  run  the  proposed  trust-threshold  based  routing  protocol  individually  to 
assess  trust  of  its  peers  using  the  same  trust  threshold  setting,  and  consequently  seleet 
trustworthy  nodes  as  carriers  for  message  routing.  Without  loss  of  generality,  we 
consider  healthiness  and  cooperativeness  for  social  trust  to  account  for  a  node's 
trustworthiness  for  message  delivery,  and  connectivity  and  energy  for  QoS  trust  to 
account  for  a  node’s  QoS  capability  to  quickly  deliver  the  message  to  the  destination 
node.  We  perform  a  comparative  analysis  of  the  resulting  trust-threshold  based 
routing  algorithm  with  epidemic  routing  [23],  social-trust-based  routing  (for  which 
only  social  trust  metrics  are  considered)  and  QoS-trust-based  routing  (for  which  only 
QoS  trust  metrics  are  considered)  and  identify  conditions  including  the  best  trust 
thresholds  to  be  used  under  whieh  trust-threshold  based  routing  outperforms  these 
baseline  routing  algorithms  for  a  DTN  consisting  of  heterogeneous  mobile  nodes  with 
vastly  different  social  and  networking  behaviors 
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2  System  Model 

Wc  consider  a  DTN  environment  without  a  centralized  trust  authority.  Nodes 
communicate  through  multi-hop  wireless  links.  Every  node  may  have  a  different  level 
of  energy  and  speed  reflecting  node  heterogeneity.  We  differentiate  uncooperative 
nodes  from  malicious  nodes.  An  uncooperative  node  acts  to  maximize  its  own  benefit 
regardless  of  the  global  benefit  of  the  DTN.  So  it  may  drop  packets  arbitrarily  just  to 
save  energy  but  it  may  decide  to  forward  a  packet  if  it  has  a  good  social  tie  with  the 
node.  A  malicious  node  acts  maliciously  with  the  intention  to  disrupt  the  main 
functionality  of  the  DTN,  so  it  can  drop  packets,  jam  the  wireless  channel,  and  even 
forge  packets.  As  soon  as  a  malicious  node  is  detected,  the  trust  value  of  the  malicious 
node  will  be  set  to  zero  and  thus  exclude  it  as  a  message  carrier  for  message 
forwarding.  A  node  initially  may  be  healthy  but  become  compromised  because  of 
being  captured  for  example  Once  a  node  is  compromised,  it  is  a  malicious  node  In 
the  paper,  we  will  use  the  terms  malicious  node  and  compromised  node 
interchangeably. 

We  consider  the  following  energy  model  The  energy  level  of  a  node  is  related  to 
the  social  encountering  activities  of  the  node  If  a  node  becomes  uncooperative,  the 
speed  of  energy  consumption  is  slowed  down  If  a  node  becomes  compromised,  the 
speed  of  energy  consumption  will  increase  since  the  node  may  perform  attacks  which 
may  consume  more  energy  .  Since  we  assume  that  wireless  devices  can  be  carried  by 
people,  the  residual  energy  level  docs  not  affect  a  node's  speed 

A  node’s  trust  value  is  assessed  based  on  direct  observations  through  monitoring, 
snooping,  and  overhearing,  and  indirect  information  like  recommendations.  To 
counter  whitewashing  or  false  information  attacks,  nodes  do  not  use  status  exchange 
information  including  encounter  history  information  because  a  malicious  node  can 
provide  fake  encounter  history  information  to  other  nodes  [24,  25]  l  or  indirect 
information,  we  use  recommendations  obtained  only  from  1-hop  neighbors  to  cope 
with  fragile  connectivity  and  sparse  node  density  in  DTNs.  The  trust  of  one  node 
toward  another  node  is  updated  upon  an  encounter  event  Our  trust  metric  consists  of 
two  trust  types:  social  trust  and  QoS  trust.  Social  trust  is  based  on  social  relationships. 
We  consider  healthiness  (or  honesty  )  and  cooperativeness  to  measure  the  social  trust 
level  of  a  node  Social  network  structure-based  properties  such  as  similarity, 
centrality,  and  betweenness  are  not  considered  because  we  do  not  use  trust  encounter 
histories  exchanged  to  avoid  self-promoting  or  false  information  attacks  by  malicious 
nodes.  QoS  trust  is  evaluated  through  the  communication  networks  by  the  capability 
of  a  node  to  deliver  messages  to  the  destination  node.  W’e  consider  connectivity  and 
energy  to  measure  the  QoS  trust  level  of  a  node.  We  define  a  node's  trust  level  as  a 
real  number  in  the  range  of  [0,  1  ].  with  1  indicating  complete  trust,  0.5  ignorance,  and 
0  complete  distrust. 

3  Trust-Threshold  Based  Routing 

Our  trust-threshold  based  routing  algorithm  builds  upon  the  notion  of  peer-to-peer 
trust  evaluation  at  runtime.  A  node  will  evaluate  its  peers  dynamically  and  will  use 
trust  thresholds  as  criteria  to  determine  if  it  can  trust  a  node  as  a  recommender  or  as  a 
message  carrier.  Two  trust  thresholds  are  used,  the  recommender  threshold  denoted 
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by  Trec  and  the  message  forwarding  threshold  denoted  by  Tf.  The  trust  value  of  node  j 
as  evaluated  by  node  i  at  time  t ,  denoted  as  Tt  7(t),  is  computed  by  a  weighted  average 
of  healthiness,  cooperativencss,  connectivity,  and  energy  selected  as  the  social  and 
QoS  trust  components  in  this  paper.  Specifically  node  /  will  compute  7jj(t)  by 

=  w1T*enUhin'5S(t)  +  w2Ttc°opern,iv'ness(0 

+ w3Tic°nnectMty  (t)  +  wj';;eray  co  ( 1 } 

where  vvt:  w2:  vv3:  vv4  is  the  weight  ratio  with  wt  +  w2  +  vv3  T  w4  =  1 .  Of  these  trust 
components  (or  properties)  in  Equation  1,  7 'healthiness^  js  about  node  fs  belief  in 

node  fs  honesty;  T™operatlvene5*(t)  is  about  node  f s  belief  in  node  fs 
cooperativeness;  j^nnecUvlty ^  js  about  node  fs  belief  in  node  fs  connectivity  to 
node  j\  representing  the  delay  of  node  i  passing  the  message  to  node  j\  TieJergy(t)  is 
about  node  fs  belief  in  node  fs  energy.  In  message  forwarding  in  DTNs.  two  most 
important  performance  metrics  arc  message  delivery  ratio  and  message  delay.  The 
rationale  of  using  these  four  trust  metrics  is  to  rank  nodes  such  that  high 
^connectivity ^  and  T™er9y  (t)  represent  low  delay,  while  high  T^althme5S  (t)  and 
TcooVerativeness^t)  lead  to  high  delivery  ratio.  We  set 

T^lthiMSQ^cjWtratin ness  ^connectivity  r««W(0)  {Q  jgnoram;e  (0.5) 

since  initially  there  is  no  information  exchanged  among  nodes.  Specifically,  node  i 
will  update  its  trust  toward  node  j  upon  encountering  node  m  at  time  t  for  the  duration 
[t,  t  4-  At]  as  follows: 

T*j{t  4*  At)  =  PtT$rectX(t  +  At)  4*  P2T$directJC(t  +  At)  (2) 

Here  A' refers  to  a  trust  property  (i.e.,  healthiness,  cooperativeness,  connectiv  ity  ,  or 
energy).  In  Equation  2,  f]l  is  a  parameter  to  weigh  node  fs  own  trust  assessment 
toward  node  j  at  time  t  4-  At,  i.e.,  "self-information,'’  and  /?2  is  another  parameter  to 
weigh  indirect  information  from  the  recommender,  i.e.,  "other-information," 
with  /?!  4-  p2  =  1.  Here  we  note  that  ty  pically  &> /?2 because  cognitive  nodes  in  a 
DTN  tend  to  trust  direct  observations  more  than  indirect  recommendations. 


3.1  Direct  Observation  Evaluation 


r™ounter.X(t+At)  l/m=y 

e-AdM  XT*(t),  if  m  *  j 

The  direct  trust  ev  aluation  of  node  j  is  given  in  Equation  3  above  in  w  hich  if  the  new 
encounter  (node  m)  is  node  j  itself,  then  node  /  can  directly  evaluate  node  j  because 
node  1  and  node  j  are  1-hop  neighbors.  We  use  T(™eoUMterJC (t  4-  Ac)  to  denote  the 
assessment  result  of  node  i  toward  node  m  in  trust  property  X  based  on  node  i's  past 
experiences  with  node  m  up  to  time  t  4-  At.  If  the  new  encounter  is  not  node  j,  then  no 
new  direct  information  can  be  gained  about  node  j.  So,  node  i  will  use  its  past  trust 
toward  node  j  obtained  at  time  /  decayed  over  the  time  interval  At  to  model  decay  of 

trust  over  timc.Wc  adopt  an  exponential  time  decay  factor,  e-AdAr  (0  <Xj  <0.1  to  limit 


T  direct* {t  +  At)  = 
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the  decay  to  at  most  50%).  Below  we  describe  how  direct  trust  evaluation  for  each 
trust  component  value  Tdjrect,x  {t)  can  be  obtained  based  on  direct  observations. 

•  j*Jalthiness'  direct(t)  :  This  provides  the  belief  of  node  i  that  node  j  is  not 
compromised  based  on  node  r  s  direct  observations  toward  node  j.  Node  i  can 
monitor  node  f  s  unhealthiness  evidences  including  dishonest  trust 
recommendation,  false  self-reporting  [26].  and  abnormal  traffic  over  the  time 
period  [0,  /]  to  estimate  7}y#aUhme5s‘  dlT€Ct{t).  It  could  be  computed  b\  the 
number  of  bad  experiences  in  healthiness  over  the  total  healthiness  experiences. 

•  7 ’•cooperative™  ss,  directly  y^is  provjcles  the  degree  of  node  j's  cooperativeness  as 

evaluated  by  node  i  based  on  direct  observations  over  the  time  period  [0,  t].  Node  i 
can  apply  overhearing  or  snooping  techniques  to  detect  cooperativeness  behaviors 
and  may  give  recent  interaction  experiences  a  higher  priority  over  old  experiences 
in  estimating  j'f  °operatlveness'  dLrect(t).  It  could  be  computed  by  the  number  of 
bad  experiences  in  cooperativeness  over  the  total  cooperativeness  experiences. 

•  7 ^connectivity,  directly  provic|es  the  probability  of  encountering  node  j  by 

node  i  at  time  t.  It  can  be  computed  by  the  number  of  encounters  between  nodes  / 
and  j  over  the  maximum  number  of  encounters  between  node  /  and  any  other  node 
over  the  time  period  [0,  t]. 

•  7 '™er9y-  dlrect(ty  Thjs  provides  the  belief  of  node  i  toward  node  f  s  energy  status 
based  on  direct  observations  toward  node  j.  Node  /  can  overhear  or  even  monitor 
node  f  s  packet  transmission  activities  over  the  time  period  [0,  t]  to  estimate  energy 
consumption  of  node  j  and  compute  T™er9y’  dl7ect(t)  as  the  percentage  of  energy 
remaining  in  node  j. 

3.2  Indirect  Information  Evaluation 

We  use  recommendations  only  from  1-hop  neighbors  because  nodes  in  a  DTN  may 
not  be  able  to  connect  to  remote  nodes  due  to  fragile  connectivity  or  sparse  node 
density.  Here  we  note  that  node  i  will  not  do  indirect  trust  evaluation  toward  a  newly 
encountered  node,  say  node  because  node  i  and  node  m  would  be  within  1-hop 
upon  encounter,  so  node  i  will  do  direct  trust  evaluation  toward  node  m  instead,  as 
discussed  in  Section  3.1. 

We  define  the  recommender  trust  threshold  Trec  such  that  if  Ti  f  (t)  >  Trcc,  node  i 
w  ill  consider  node  j  as  a  “trustworthy”  recommender  (or  plainly  as  a  good  node)  at 
time  t  If  node  i  believes  that  a  neighbor,  say  node  c\  is  a  good  node,  i.e..  Tix(t  +  At)  > 
TrfC>  node  i  w  ill  use  node  c  as  a  recommender  to  update  its  beliefs  toward  other  nodes. 

^indirect,  X  +  Af) 

if  rn  =  j 

'  e~*‘M  X  rj(£),  if  m*j  and  |K(|  =  0  (4) 

£  c6R,{^c(t  +  at)  x  T*j(t  +  at)} 

J  ZcER,  T*c(t  +  At) 


if  m*J  and  |/?J  >  0 
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The  indirect  trust  evaluation  toward  node  j  is  given  in  Equation  4  above  where  R{  is 
a  set  containing  node  i' s  1-hop  neighbors  with  7yc(t  +  At)  >  Trec%  and  \Rt  \  indicates  the 
cardinality  of  Rt.  If  the  new  encounter  is  node  j  itself,  then  there  is  no  indirect 
recommendation  for  node  y,  so  node  i  will  use  its  past  trust  toward  node  j  obtained  at 
time  t  decayed  over  the  time  interval  At  to  model  decay  of  trust  over  time.  If  the  new 
encounter  is  not  node  j  and  node  i  considers  node  c  as  trustworthy,  i  e..  Ti  c(t  +  At)  > 
Trec  then  node  c  can  provide  its  recommendation  to  node  i  for  evaluating  node  j.  In 
this  case,  node  i  weighs  the  recommendation  provided  by  node  c  by  normalizing  it 
with  referral  trust.  Moreover,  the  more  recommendations  node  i  receives  from 
trustworthy  nodes,  the  more  accurate  the  trust  value  of  node  j  can  be  Our 
recommender  trust  threshold  design  provides  robustness  against  bad-mouthing  or 
good-mouthing  attacks  since  only  recommendations  from  good  nodes  are  taken  into 
consideration. 

3.3  Message  Routing 

Ti  j(t)  in  Equation  1  can  be  used  by  node  i  (if  it  is  a  message  carrier)  to  decide,  upon 
encountering  node  nu  if  it  should  forward  the  message  to  node  m  with  the  intent  to 
shorten  the  message  delay  or  improve  the  message  delivery  ratio.  We  consider  a  ft- 
permissiblc  policy  and  a  forwarding  trust-threshold  (Tf)  in  this  paper,  l  e..  node  /  will 
pass  the  message  to  node  m  \i'Tim(t  +  At)  >  Tf  as  well  as  is  in  the  top  ft 

percentile  among  all  Tt  y(t)'s.  Here,  Tf  is  defined  as  a  minimum  trust  threshold  for  the 
selection  of  the  next  message  carrier.  The  reason  for  using  Tf  is  to  guarantee  that  a 
next  message  carrier  is  trustworthy.  The  performance  metrics  of  interest  arc  message 
delivery  ratio,  message  delay  and  message  overhead.  We  consider  only  single-copy 
message  routing  and  buffer  management  is  not  considered  in  this  paper.  Below  we 
develop  a  performance  model  to  identify  the  best  message  forwarding  threshold 
Tf  (for  accepting  the  next  message  carrier)  and  the  best  recommendation  threshold 
Trec(for  accepting  a  recommender)  to  optimize  performance  of  trust-threshold  based 
routing  in  DTNs,  as  well  as  for  performance  comparison  with  baseline  message 
routing  protocols. 

4  Performance  Model 

Wc  develop  a  probability  model  to  analyze  the  performance  of  the  proposed  trust- 
threshold  based  routing  protocol  for  DTN  message  forwarding.  The  probability  model 
is  based  on  stochastic  Petri  net  (SPN)  techniques  [27)  due  to  its  ability  to  handle  a 
large  number  of  states.  The  SPN  model  is  shown  in  Fig.  1  consisting  of  5  event 
subnets,  namely,  in  clockwise  order,  energy,  location,  cooperativeness,  intrusion 
detection,  and  compromise.  The  purpose  of  the  SPN  model  is  to  yield  the  ground  truth 
status  of  a  node  (i.e..  healthiness,  cooperativeness,  connectivity,  and  energy)  in  the 
presence  of  uncooperative  and  malicious  nodes  and  to  derive  the  trust  relationship 
with  other  nodes  in  the  system  Without  loss  of  generality,  we  consider  a  square¬ 
shaped  operational  area  consisting  of  m*m  sub-grid  areas  with  the  width  and  height 
equal  to  the  radio  range  ( R ).  Initially  nodes  are  randomly  distributed  over  the 
operational  area  based  on  uniform  distribution.  A  node  randomly  moves  to  one  of  four 
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locations  in  four  directions  (i.e.,  north,  west,  south,  and  east)  in  accordance  w  ith  its 
mobility  rate.  To  avoid  end-effeets,  movement  is  bounced  back  The  location  subnet 
produces  the  probability  that  node  i  is  in  a  particular  location  L  at  time  t  This 
information  along  with  the  location  information  of  other  nodes  at  time  t  provides  us 
the  probability  of  two  nodes  encountering  w  ith  eaeh  other. 


LOCATION^) 

T  ENERGY  T  LOCATION 

\  I  ►C^dcn^)  ^ 

T  COMPRO  x  DETECT  T  UNCOOP  FR 

Fig.  I.  SPN  Model 

Below  we  explain  how  we  construct  the  SPN  model  for  describing  a  node’s  ground 
truth  status  in  terms  of  its  location,  energy  level,  degree  of  healthiness  (i.e..  w  hether 
or  not  a  node  is  compromised  or/and  detected),  and  degree  of  eooperativeness. 

Energy:  We  use  the  energy  subnet  to  describe  the  energy  status  of  a  node  Place 
ENERGY  represents  the  current  energy  level  of  a  node,  An  initial  energy  level  of  each 
node  is  assigned  according  to  node  heterogeneity  information.  A  token  is  taken  out 
when  transition  T_ENERCY  fires.  The  rate  of  transition  T  ENERGY  indicates  the 
energy  consumption  rate  whieh  depends  on  the  ground  truth  status  of  the  node  (i.e., 
uneooperativeness  and  healthiness). 

Location:  We  use  the  location  subnet  to  describe  the  location  status  of  a  node. 
Transition  TLOCATION  is  triggered  when  the  node  moves  to  a  randomly  selected 
area  out  of  four  different  directions  from  its  eurrent  location  with  the  rate  calculated 
as  <j0/R  based  on  the  node  speed  a0  and  wireless  radio  range  R. 

Connectivity:  We  use  the  connectivity  subnet  to  measure  connectivity  of  node  i  to 
node  j  by  the  time-averaged  probability  that  node  i  and  node  j  are  within  one  hop 
during  [/-nAt,  /].  modeling  not  only  chances,  but  also  recency  of  encountering  events 
between  node  i  and  node  j.  This  ean  be  obtained  by  knowledge  of  location 
probabilities  of  node  i  and  node  j  during  [/-nAt,  /].  Without  considering  recency,  the 
interval  would  be  [0,  t]. 

Healthiness:  We  use  the  compromise  subnet  and  the  intrusion  detection  subnet  to 
describe  the  healthiness  status  of  a  node.  A  node  becomes  compromised  when 
transition  TCOMPRO  fires  and  then  a  token  is  put  in  place  CN  to  represent  the  node 
has  been  eaptured  and  compromised.  The  rate  to  T  COMPRO  is  Acom,  the  per-node 
compromising  rate  given  as  input  to  the  SPN  model.  Our  model  is  generic  in  handling 
intrusion  detection  as  follows.  In  ease  an  intrusion  detection  system  (IDS)  exists,  it 
would  be  characterized  by  a  false  negative  probability  Pfn  and  a  false  positive 
probability  Pfp  given  as  input  to  the  SPN  model.  If  the  node  is  compromised  and  it  is 
detected  by  the  IDS.  transition  T  DETECT  fires  and  a  token  moves  to  place  DCS. 
The  transition  rate  to  T  DETECT  is  given  by  (1  —  Pfn)/TlDS  where  TlDS  is  the  IDS 


(^ENERGY^ - J 
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detection  interval  and  1  —  P^n  is  the  probability  that  the  IDS  correct]}  detects  the 
compromised  node.  If  the  node  is  good  but  is  falsely  identified  as  a  bad  node, 
transition  TDETECT  also  fires  and  a  token  moves  to  place  DCN.  The  transition  rate 
to  T_DETECT  is  given  by  PfP/T!DS  and  Pfp  is  the  probability  that  the  IDS  incorrectly 
diagnoses  a  good  node  as  a  bad  node.  Thus,  the  transition  rate  to  T_DETECT  is  a 
weighted  sum  of  these  two  transition  rates,  conditioning  on  if  the  node  is 
compromised  or  not,  which  we  can  easily  determine  from  the  SPN  model.  In  ease  an 
IDS  does  not  exist,  this  intrusion  detection  subnet  would  not  exist  and  can  be  removed 
from  the  SPN  model. 

Cooperativeness:  We  use  the  cooperative  subnet  to  describe  the  cooperative  status  of 
a  node.  Place  UCPN  indicates  whether  a  node  is  uncooperative  or  not  If  a  node 
becomes  uncooperative,  a  token  goes  to  UCPN  by  triggering  TUNCOOPER.  The 
transition  rate  to  T_UN COOPER  is  Auncooper  the  per-node  uncooperati\e  rate  given 
as  input  to  the  SPN  model 

The  SPN  model  described  above  yields  the  “ground  truth"  status  of  each  node, 
which  would  allow  us  to  calculate  as  follows.  When  node  /  encounters  node y, 

node  /  will  assess  node  j  in  trust  property  X  to  yield  Tiyncounter‘  x(t)  based  on  its  past 
experiences  up  to  time  /.  Because  node  i  has  prior  close  interaction  experiences  with 
node  j  (including  the  current  encounter),  node  i  has  good  knowledge  about  w  hether 
node  j  is  cooperative  or  not  through  snooping  and  overhearing.  Hence,  node  z’s  direct 
assessment  in  node  fs  cooperativeness  at  the  encounter  time  /  is  the  same  as  or  close 
to  the  ground  truth  cooperativeness  status  of  node  j  at  time  /.  Consequently, 
jencountei.  cooperativeness ^  jn  Equation  3  is  simply  equal  to  the  probability  that 

place  UCPN  in  node  j  does  not  contain  a  token  at  time  /,  which  we  can  compute  easily 
from  the  SPN  model.  Similarly .  node  /  can  fairly  accurately  assess 
jencounteu  connectivity ^  ^y  consulting  its  encounter  history  with  node  j  o\er 

[t  —  nAt,  t].  This  quantity  ean  be  obtained  by  utilizing  the  SPN  output  regarding  the 
node  location  probability  at  time  /.  For  the  healthiness  trust  component,  in  case  an 
IDS  exists,  node  /  knows  that  node  j  is  malicious  when  it  is  detected  and  a  message  is 
announced  to  the  system,  i.e.,  when  node  fs  place  DCN  (in  Fig.l)  is  not  zero  Thus, 
we  can  compute  j^counter>  healthiness^  the  probability  that  place  DCN  in  node  j 
does  not  contain  any  token  at  time  t  In  case  an  IDS  docs  not  exist,  we  can 
approximate  7.*ncounter-  healthiness (f)  ^  the  probability  that  place  CN  in  node  /  does 
not  contain  any  token  at  time  /.  Lastly,  node  /  can  overhear  or  even  monitor  node  fs 
packet  transmission  activities  over  the  time  period  [0,  t]  to  estimate 
T encounter  energy  V\  hich  would  be  close  to  the  ground  truth  energy  status  of  node 
j  and  can  be  obtained  easily  from  the  SPN  output  by  inspecting  place  UN  ERG )  Once 
T encounter,  x ^  js  0btaincci  n0(je  /  ean  update  its  ^  (t)  based  on  Equation  2,  and 

subsequently,  can  obtain  based  on  Equation  1 . 
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5  Results 

In  this  section,  we  show  numerical  results  and  provide  physical  interpretation  of  the 
results  obtained.  Table  1  lists  the  default  parameter  values  used.  For  trust-threshold 
based  routing,  we  set  w1:w2:  w3:w4  =  0.25: 0.25: 0.25:0.25  for  healthiness: 
cooperativeness:  connectivity:  energy.  We  setup  20  nodes  with  vastly  different  initial 
energy  levels  in  the  system  moving  randomly  in  a  8*8  operational  region  with  the 
mobility  rate  of  each  node  being  <70  in  the  range  of  [1,4]  m/sec,  and  with  each  area 
covering  250  m  radio  radius.  There  are  two  sets  of  nodes,  namely,  good  nodes  and  bad 
nodes  (i,e  ,  uncooperative  and/or  malicious  nodes).  Good  nodes  are  the  ones  with  the 
compromise  rate  being  zero  and  the  uncooperative  rate  being  zero.  Uncooperative 
nodes  have  a  non-zero  uncooperative  rate  A„„coo/vr,  and  once  thev  become 
uncooperative  they  stay  as  uncooperative.  Compromised  nodes  have  a  non-zero 
compromise  rate  Xcom  in  the  range  of  [l/480min,  l/160min]  We  assume  an  IDS  exists 
with  the  false  negative/positive  probability  being  1%.  For  indirect  trust  evaluation,  we 
use  recommendations  only  from  1-hop  neighbors  whose  trust  is  higher  than  the 
recommender  threshold  Trec.  We  set  pip2=  0  8:0.2  to  place  higher  trust  on  direct 
observations.  The  initial  trust  level  is  set  to  ignorance  (i  e  ,  0.5)  for  all  trust 
components  since  initially  nodes  do  not  know  each  other  We  setTd.  the  decay 
coefficient,  to  0.001  (such  that  e~*dAt  =  0.995)  to  model  small  trust  decav  with  time 
Trust-threshold  routing  is  performed  based  on  the  algorithm  described  in  Section  3 
using  the  message  forwarding  threshold  (Ty)  being  applied  to  all  nodes  in  a  DTK 


Table  1.  Parameters  and  Their  Default  Values. 


Parameter 

Value 

Parameter 

Value 

Parameter 

Value 

Parameter 

Value 

m*m 

8*8 

R 

250 m 

/  ^ uncooper 

300  5 

0.001 

Pfn ■  Pfp 

1% 

At 

300  s 
(5  min) 

<*a 

[1,4]  rti  s 

n 

90% 

Pr-fh 

0.8:0.2 

Eo 

(12,  24]  hrs 

I'Kom 

[160.480] 

min 

T/D5 

300.? 

5.1  Optimal  Trust  Thresholds  for  Routing  in  DTNs 

In  this  section,  we  investigate  the  optimal  values  of  Trec  and  7y  under  trust-threshold 
based  routing  in  DTNs.  Note  that  Ty  and  Trec  are  the  minimum  trust  thresholds  for  the 
selection  of  a  next  message  carrier  and  for  the  selection  of  recommenders, 
respectively.  First,  we  consider  a  message  forwarding  scenario  in  which  in  each  run 
we  randomly  pick  a  source  node  s  and  a  destination  node  d.  The  source  and 
destination  nodes  picked  are  always  good  nodes.  There  is  only  a  single  copy  of  the 
message  initially  given  to  node  s.  We  let  the  system  run  for  30  min  to  allow  nodes  to 
accumulate  experiences  and  start  the  message  forwarding  afterward  in  each  run. 
During  a  message-passing  run  every'  node  /  updates  its  7^  (0  for  all  j  's  based  on 
Equation  1.  In  particular,  the  current  message  carrier  uses  Tt)(t)  to  judge  if  it  should 
pass  the  message  to  a  node  it  encounters  at  time  /.  If  the  message  carrier  is  malicious. 
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the  message  is  dropped  (a  weak  attack)  If  the  message  carrier  is  uncooperative,  the 
message  delivery  continues  with  50%  of  the  chance.  A  message  delivery  run  is 
completed  when  the  message  is  delivered  to  the  destination  node,  or  the  message  is 
lost  before  it  reaches  the  destination  node.  Data  are  collected  for  2000  runs  from 
which  the  message  delivery  ratio,  delay  and  overhead  performance  measurements  are 
calculated 

Fig.  2  shows  the  effect  of  Tf  and  Trec  on  message  delivery  ratio  as  the  percentage 
of  malicious  and  uncooperative  nodes  varies.  We  vary  Tf  from  0.6  to  0.9  and 
Trec  from  0.6  to  0.9  to  cover  a  wide  range  of  possible  values.  We  see  that  the  message 
delivery  ratio  becomes  higher  as  Tf  increases.  Specifically,  as  the  percentage  of 
malicious  and  uncooperative  nodes  increases,  the  message  delivery  ratio  becomes 
lower  with  Tf =0,6  or  0.7,  while  the  message  delivery  ratio  approaches  1  with  7^=0. 8 
or  0.9  The  reason  is  that  trust-threshold  based  routing  behaves  like  a  "direct  delivery" 
approach  as  Tf  increases,  the  effect  of  which  is  especially  pronounced  when  there  is  a 
high  malicious/uncoopcrative  node  population  More  specifically,  a  carrier  is  likely  to 
hold  the  message  until  it  runs  into  a  trustworthy  node.  There  may  be  an  extreme  case 
where  node  i  can  store  a  message  until  it  encounters  the  destination  node  because  it 
could  not  encounter  a  node  with  trust  greater  than  Tf,  We  also  observe  that 
Tf  dominates  Trec  in  message  delivery  ratio  whieh  we  observe  is  relatively  insensitive 
to  Trec.  This  is  mainly  because  using  fewer  (e.g.,  when  Tr€C  =  0.8)  or  more 
reeommenders  (e.g.,  when  Trec=  0.6)  to  provide  recommendations  does  not  affect  the 
indirect  trust  evaluation  outcome  much,  as  long  as  the  reeommenders  are  good  nodes. 


i  r  -o.K  ,v  i 


%  of  malicious  and  selfish  nodes 
Fig.  2.  Effect  of  Tf  and  Trec  on  Message  Delivery  Ratio 

Fig.  3(a)  and  3(b)  show  the  message  delay  and  message  overhead  (measured  by  the 
number  of  copies  propagated  per  message),  respectively,  as  a  function  of  the 
percentage  of  malicious  and/or  uncooperative  nodes,  with  Tf  varying  in  the  range  of 
[0.6,  0.9]  and  Trec  Fixed  at  0.6  to  isolate  its  effect.  Here  we  only  consider  messages 
that  are  delivered  successfully.  We  first  observe  that  both  the  message  delay  and  the 
message  overhead  decrease  as  the  malicious/uneooperative  node  population  increases 
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because  of  the  smaller  probability  of  encountering  trustworthy  nodes  in  message 
forwarding.  In  general,  we  see  Tf  =  0.9  consistently  performs  better  than  the  others  in 
terms  of  message  delay  and  message  overhead  over  a  wide  range  of 
malieious/uneooperative  node  population  We  attribute  it  to  the  fact  that  with  7}  =  0.9, 
trust-threshold  based  routing  behaves  like  “direct  delivery”  with  very  little  copies 
being  passed  around  to  intermediate  message  carriers,  resulting  in  a  more  direct  route 
to  reach  the  destination  node.  This  is  true  in  our  DTN  scenario  where  nodes  can 
encounter  each  other  with  non/ero  probability  due  to  random  movement  In  situations 
where  node  movement  is  not  random  and  the  encountering  probability  may  be  zero  or 
very  small  among  eertain  nodes,  Tf  =  0.9  may  not  necessarily  always  perform  the 
best.  Our  model  helps  identify  the  best  Tf  that  minimizes  the  message  delay/overhead. 


■  Tf=0.6  “  Tf=0.7  Tf=0.8  *Tf=0.9 


%  of  malicious  and  uncooperative 
nodes 


0  20  40  150  HO 

%  of  malicious  and  uncooperative 
nodes 


(b)  Copies  Propagated  per  Message 


(a)  Message  Delay. 

Fig.  3.  Effeet  of  Tf  on  Message  Delay  and  Message  Overhead 
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%  of  malicious  &  uncooperative  nodes  %  of  malicious  &  uncooperative  nodes 


(a)  Message  Delay 


(b)  Copies  Propagated  per  Message 


Fig.  4.  Effect  of  Trec  on  Message  Delay  and  Message  Overhead 

Fig  4(a)  and  4(b)  show  the  message  delay  and  message  overhead,  respectively,  as 
a  function  of  the  percentage  of  malicious  and/or  uncooperative  nodes,  with  Trec 
varying  in  the  range  of  [0.5,  0.9]  and  Tf  fixed  at  0.9  to  isolate  its  effect.  Here  we  see 
that  Trec  =  0.6  performs  slightly  better  than  the  other  Trec  values  in  terms  of  the 
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message  delay  and  the  number  of  copies  propagated  per  message.  The  reason  is  that 
the  recommenders  are  all  good  nodes  when  0.6  <  Trec  <  0.9  and  Trec  =  0.6  allows 
more  good  recommenders  to  provide  indirect  recommendations,  thus  proving  a  more 
accurate  indirect  trust  assessment.  We  also  observe  that  Trec  =  0.6  has  the  shortest 
message  delay  and  the  lowest  message  overhead  over  a  wide  range  of  the  percentage 
of  malicious  and  uncooperative  nodes. 

In  summary,  we  conclude  that  there  exist  optimal  message  forwarding  threshold  Tf 
and  recommender  threshold  Trec  in  trust-threshold  based  routing  to  best  tradeoff 
message  deliver)  ratio,  message  delay,  and  message  overhead,  adapting  to  application 
or  network  environment  characteristics. 


5.2  Comparative  Performance  Analysis  of  Trust-Threshold  Based  Routing 

In  this  section,  we  perform  a  comparative  analysis  of  trust -threshold  based  routing 
against  epidemic  routing  [23],  social-trust-bascd  routing,  and  QoS-trust-based  routing. 
For  social-trust-based  routing,  we  set  Wj:  w2:w3:iV4  =  0.5:  0.5: 0:  0,  and  for  QoS-trust- 
based  routing,  we  set  wl:w2:  w3:  w4  —  0:0: 0.5:0.5.  Here  we  note  that  social-trust- 
bascd  routing  and  QoS-trust-based  routing  are  special  cases  of  trust-threshold  based 
routing,  with  social-trust-based  routing  using  only  social  trust  metrics  (healthiness  and 
cooperativeness)  and  QoS-trust-based  routing  using  only  QoS  trust  metrics 
(connectivity'  and  energy)  for  trust  evaluation.  Thus,  the  design  concept  of  trust 
thresholds  also  applies  to  them.  To  show  the  effect  of  Tf,  we  evaluate  the  performance 
of  these  two  routing  algorithms  with  and  without  7y.  The  dashed  line  is  used  for  the 
“without  Tf'  case,  while  the  solid  line  is  for  the  “with  Tf'  case  using  the  optimal  Tf 
value  identified  in  Section  5.1.  Epidemic  routing  does  not  use  the  design  parameter 
Tf,  so  only  a  solid  line  is  shown  for  epidemic  routing 
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Fig.  5.  Message  Delivery  Ratio  ( Trec  =  0.6,  Tf  =  0.9). 


Fig.  5  shows  the  message  delivery  ratio  as  a  function  of  the  percentage  of 
malicious  and  uncooperative  nodes  in  a  DTN.  We  see  that  the  routing  protocols  with 
Tf  outperform  those  without  Tf  in  the  delivery  ratio.  Also  trust-threshold  based 
routing  with  Tf  and  social-trust  routing  with  Tf  perform  better  than  QoS-trust-based 
routing  with  Tf  and  epidemic  routing,  with  the  delivery  ratio  approaching  1  over  a 
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wide  range  of  malicious/uncooperative  node  population.  This  is  attributed  to  the 
ability  of  trust-threshold  based  routing  and  social-trust-based  routing  being  able  to 
differentiate  trustworthy  nodes  from  uncooperative  and  malicious  nodes  and  select 
trustworthy  nodes  to  relay  the  message.  We  also  note  that  performance  of  epidemic 
routing  deteriorates  when  there  is  a  high  bad  node  population  because  it  does  not 
select  trustworthy  message  carriers.  This  result  demonstrates  the  effectiveness  of 
incorporating  social  trust  into  the  decision  making  process  for  DTN  message  routing, 
as  well  as  using  Tf  to  select  the  next  message  carrier  to  yield  high  delivery  ratio. 
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Fig.  6.  Message  Delay  (Trec  —  0.6,  7}  =  0.9). 

Fig.  6  shows  the  average  message  delav  experienced  per  message  considering  only 
those  messages  delivered  successfully  as  a  function  of  the  percentage  of  malicious 
and  uncooperative  nodes.  Here  we  first  note  that  the  message  delay  for  all  routing 
algorithms  except  epidemic  routing  decreases  as  the  percentage  of  malicious  and 
uncooperative  nodes  increases.  This  is  because  the  probability  of  being  able  to 
forward  the  message  to  a  good  node  decreases  as  more  bad  nodes  exist  in  the  system. 
Epidemic  routing  is  insensitive  to  this  because  it  is  flood-based  in  nature  and  will  try 
all  possible  routes  to  reach  the  destination  node.  As  a  result,  the  delav  of  epidemic 
routing  represents  the  ideal  smallest  possible  delay  experienced  for  routing  a  message. 
Fig.  6  shows  epidemic  routing  indeed  performs  the  best  among  all  in  terms  of  delay.  It 
also  shows  that  with  similar  reasoning,  all  routing  algorithms  without  Tf  approach  the 
ideal  performance  obtainable  from  epidemic  routing  as  the  percentage  of  malicious 
and  uncooperative  nodes  increases. 

Another  result  is  that  QoS-trust-based  routing  performs  better  than  trust-threshold 
based  routing  and  soeial-trust-based  routing  in  terms  of  message  delay  This  is 
because  QoS-trust-based  routing  only  uses  the  connectivity  QoS  metric  (representing 
the  delay  to  encounter  the  next  message  carrier)  and  the  level  of  the  residual  energy 
metric  as  the  criteria  to  select  a  message  carrier.  This  result  indicates  that  if  the 
objective  is  to  minimize  the  message  delay,  w*c  should  set  the  weights  associated  with 
connectivity  and  energy  (QoS  trust  metrics)  considerably  higher  than  those  for 
healthiness  and  cooperativeness  (social  trust  metrics)  for  trust-threshold  based  routing 
to  approach  the  performance  of  QoS-trust-based  routing  in  message  delay. 
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Fig.  7.  Number  of  Copies  Propagated  per  Message  ( Trec  =  0.6,  Tf  =  0.9) 


Finally,  Fig.  7  shows  the  message  overhead  measured  by  the  number  of  copies 
forwarded  to  reach  the  destination  node  for  those  messages  successfully  delivered. 
We  see  that  all  trust-based  routing  algorithms,  with  or  without  Tf,  outperform 
epidemic  routing  considerably  in  message  overhead  because  trust  is  being  utilized  to 
regulate  message  forwarding.  In  particular  QoS-trust-based  routing  with  Tf  (the 
bottom  curve)  performs  the  best  among  all  routing  protocols.  This  result  again 
reassures  the  effectiveness  of  our  trust  threshold  design.  The  reason  that  trust- 
threshold  based  routing  and  social-trust-based  routing  use  more  message  copies  than 
QoS-trust-based  routing  is  that  the  path  selected  by  trust-threshold  based  routing  or 
soeial-trust-based  routing  may  not  he  the  most  direet  route  as  they  attempt  to  avoid 
uncooperative  or  malicious  nodes.  The  result  also  suggests  that  if  we  want  to 
minimize  message  overhead,  we  should  set  the  weights  associated  w  ith  connectivity 
and  energy  (QoS  trust  metrics)  considerably  higher  than  those  for  healthiness  and 
cooperativeness  (social  trust  metrics)  for  trust-threshold  based  routing,  in  order  to 
approach  the  performance  of  QoS-trust-based  routing  in  message  overhead. 

In  summary,  from  Figs.  5-7,  we  sec  that  our  proposed  trust-threshold  based  routing 
algorithm  operating  under  identified  optimal  Tf  values  can  effectively  trade  off 
message  overhead  (Fig.  7)  and  message  delay  (Fig.  6)  for  a  significant  gain  in 
message  delivery  ratio  (Fig.  5).  Moreover,  our  analysis  results  reveal  that  there  exists 
an  optimal  weight  setting  in  terms  of  w1:w2:  vv3:  w4  (c.g.,  social-trust-bascd  \s.  trust- 
threshold  based  vs.  QoS-trust-based  routing)  to  best  balance  the  effect  of  social  trust 
metrics  vs.  QoS  trust  metrics  to  maximize  the  message  deliver}  ratio  without 
compromising  message  delay  and/or  message  overhead  requirements 


6  Conclusion 

In  this  paper,  we  have  proposed  and  analyzed  a  trust-threshold  based  routing 
algorithm  with  the  design  objective  to  maximize  the  message  deliver}  ratio  while 
satisfying  message  delay  and  message  overhead  requirements.  Our  algorithm 
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leverages  a  trust  management  protocol  incorporating  both  social  and  QoS  trust 
metrics  for  peer-to-peer  trust  evaluation,  as  well  as  trust  thresholds  for  selecting 
rccommcnders  for  indirect  trust  evaluation  and  for  selecting  the  next  message  carrier 
for  message  forwarding.  Our  performance  analysis  results  demonstrate  that  when 
operating  under  proper  trust  thresholds  and  social  vs.  QoS  trust  weight  settings  as 
identified  in  the  paper,  trust-threshold  based  routing  can  effectively  trade  off  message 
delay  and  message  overhead  for  a  significant  gain  in  message  delivery  ratio  to  achieve 
the  design  objective.  In  the  future  we  plan  to  extend  the  research  to  investigate  the 
best  way  to  compose  the  overall  trust  metric  from  QoS  and  social  trust  components 
(not  necessarily  limited  to  the  two  QoS  and  two  social  trust  components  considered  in 
this  paper)  and  identify  the  optimal  settings  of  design  parameters,  when  given  a  DTN- 
based  application  characterized  by  a  set  of  operational  and  environmental  variables 
specifying  the  energy  consumption  model,  the  application  failure  model,  the  node 
compromise  model,  the  social  and  QoS  behavior  model,  the  mobility  model  (random 
vs.  random  waypoint  vs.  multi-group-based  vs.  traces),  and  the  application 
requirements  (e.g ,  message  delivery  ratio,  delay  and  overhead  requirements  for 
message  routing  applications). 
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